Nimbus Manticore Expanded Attacks With AI-Assisted Malware and Fake Zoom Installers
May 26, 2026 
Nimbus Manticore accelerated cyberattacks during wartime, using AI-assisted malware, fake Zoom installers, and SEO poisoning.
When the United States launched Operation Epic Fury against Iran at the end of February 2026, most analysts expected the country’s cyber apparatus to hunker down and weather the storm. That’s not what happened. Instead, researchers at Check Point have documented something more unsettling: the Iran-linked threat actor Nimbus Manticore (aka UNC1549) used the chaos of active conflict as cover to accelerate its operations, debut new malware, and experiment with delivery methods it had never tried before.
“The campaign leveraged malicious lures impersonating organizations in the aviation and software sectors across the United States, Europe and the Middle East.” reads the report published by CheckPoint. “For the first time, we observed the use of SEO poisoning as an additional malware delivery method.”
The APT group is affiliated with Iran’s Islamic Revolutionary Guard Corps. It has been on the radar of threat intelligence experts for years, primarily targeting defense, aviation, and telecommunications organizations through career-themed phishing, fake job opportunities convincing enough to fool employees at major companies. What Check Point observed between February and April of this year, however, goes well beyond that established playbook.
The campaign unfolded in three distinct waves.
The first began even before the conflict broke out, as tensions were still building. Employees at software and aviation companies in Saudi Arabia and Australia received bogus career offers, luring them into downloading a ZIP archive hosted on OnlyOffice. Inside was a benign Microsoft-signed executable accompanied by a malicious configuration file that exploited a technique called AppDomain hijacking, abusing the .NET runtime to silently load a rogue DLL under the cover of a trusted process. This delivered an updated variant of the group’s existing MiniJunk backdoor.
The second wave, timed to the opening weeks of Operation Epic Fury, showed the group rapidly pivoting its tactics. Alongside the usual fake airline job offers, the attackers also deployed a trojanized Zoom installer, almost certainly distributed via fake meeting invitations. The installer was not a crude knockoff; it demonstrated detailed knowledge of the legitimate Zoom installation process, even monitoring for the creation of a specific scheduled task that Zoom normally generates during setup, then silently hijacking that task to establish persistence without triggering obvious alarms. This wave also introduced a previously unseen backdoor that Check Point has named MiniFast, replacing MiniJunk as the final payload.
“The operation introduced a previously undocumented backdoor, named MiniFast, which appears to incorporate AI-assisted development practices, enabling the threat actor to rapidly develop and adapt tooling while maintaining high operational availability during the war.” states the report.
What makes MiniFast technically noteworthy is not just its capabilities, though it is a fully featured remote access trojan supporting file operations, process management, privilege escalation, and DLL loading, but the way it appears to have been written.
“This campaign also provides multiple indications that the threat actor leveraged AI-assisted development during the malware creation.” states the report. “We see evidence for this in both the initial access loaders and within the MiniFast backdoor itself. Several coding patterns and implementation details strongly suggest the use of AI-generated or AI-assisted code during development, including excessive error handling and defensive programming logic, even around simple API calls such as GetUserName.”
The hallmarks are fairly recognizable to anyone who has spent time reviewing AI-generated code: overly descriptive function names, verbose debug-style error strings embedded throughout the codebase, and modular code organization that feels slightly out of proportion with the actual complexity of the program. It suggests that Nimbus Manticore, rather than relying solely on experienced malware developers, is now using AI tooling to accelerate production and fill capability gaps mid-operation.
The third wave, observed in April after a ceasefire, marked the group’s first use of a different delivery mechanism.
“This malware delivery method differs from Nimbus Manticore’s usual infection chains, which typically rely on career-themed phishing lures. In this campaign, the actor abuses search engine optimization techniques by registering dozens of domains that link to the bogus domain, getsqldeveloper[.]com.” continues the report. “This is likely an attempt to increase the site’s visibility through link-based reputation signals.”
Threat actors set up a fake site impersonating a legitimate download page for Oracle’s SQL Developer, a widely used database management tool. Users who found it, and many did, as it ranked prominently in Bing and DuckDuckGo results for common search terms, received a malware-laced installer delivering the MiniFast backdoor. No spearphishing email, no fake job offer. Just a developer searching for software they actually needed.
Taken together, the three waves paint a picture of a group that did not simply survive the pressure of operating during an active military conflict but found in it a kind of operational urgency.
“The ongoing conflict in the Middle East, combined with the operational demands of wartime activity, appears to have significantly accelerated their malware evolution.” states the report. “As an IRGC-affiliated entity operating under heightened geopolitical conditions, Nimbus Manticore demonstrated a rapid adoption cycle for new techniques, tooling, and operational methodologies.”
From the defenders’perspective, the expansion into SEO poisoning is perhaps the most significant tactical development. Spearphishing, for all its effectiveness, requires identifying and targeting specific individuals. SEO poisoning is passive and scalable, it simply waits for victims to arrive. Combined with AI-assisted development that shortens the gap between an idea and a working implant, Nimbus Manticore is becoming a harder adversary to predict.
Nimbus Manticore mainly targets organizations in Europe, the Middle East, and Africa, especially in Israel and the UAE, but recent campaigns expanded to the U.S. aviation sector. The group tailors phishing lures to specific industries, using fake airline hiring portals to target aviation employees. Current operations also target software development organizations, aligning with the IRGC’s broader intelligence-gathering objectives.
The cybersecurity firm provided indicators of compromise (IoCs) and YARA rules for these campaigns.
“As an IRGC-affiliated entity operating under heightened geopolitical conditions, Nimbus Manticore demonstrated a rapid adoption cycle for new techniques, tooling, and operational methodologies.” concludes the report. “The actor’s activity during Operation Epic Fury highlights their increasing adaptability, particularly through the integration of AI-assisted malware development, novel infection vectors, and advanced stealth mechanisms.”
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
Pierluigi Paganini
(SecurityAffairs – hacking, Nimbus Manticore)
